Djam/pam
1
0
Fork 0
mirror of https://abf.rosa.ru/djam/pam.git synced 2025-02-23 08:22:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

sync to certified branch, 12.08.2014

Browse source
This commit is contained in:
Alex Burmashev 2014-08-12 14:34:38 +04:00
parent 0ad5b38a1a
commit 8bd9dbe021
3 changed files with 74 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
107.patch Normal file
View file

@ -0,0 +1,33 @@
diff --git a/modules/pam_timestamp/pam_timestamp.c b/modules/pam_timestamp/pam_timestamp.c
index 5193733..b3f08b1 100644
--- a/modules/pam_timestamp/pam_timestamp.c
+++ b/modules/pam_timestamp/pam_timestamp.c
@@ -158,7 +158,7 @@ check_tty(const char *tty)
tty = strrchr(tty, '/') + 1;
}
/* Make sure the tty wasn't actually a directory (no basename). */
- if (strlen(tty) == 0) {
+ if (!strlen(tty) || !strcmp(tty, ".") || !strcmp(tty, "..")) {
return NULL;
}
return tty;
@@ -243,6 +243,17 @@ get_ruser(pam_handle_t *pamh, char *ruserbuf, size_t ruserbuflen)
if (pwd != NULL) {
ruser = pwd->pw_name;
}
+ } else {
+ /*
+ * This ruser is used by format_timestamp_name as a component
+ * of constructed timestamp pathname, so ".", "..", and '/'
+ * are disallowed to avoid potential path traversal issues.
+ */
+ if (!strcmp(ruser, ".") ||
+ !strcmp(ruser, "..") ||
+ strchr(ruser, '/')) {
+ ruser = NULL;
+ }
}
if (ruser == NULL || strlen(ruser) >= ruserbuflen) {
*ruserbuf = '\0';

33
pam-CVE-2014-2583.patch Normal file
View file

@ -0,0 +1,33 @@
diff --git a/modules/pam_timestamp/pam_timestamp.c b/modules/pam_timestamp/pam_timestamp.c
index 5193733..b3f08b1 100644
--- a/modules/pam_timestamp/pam_timestamp.c
+++ b/modules/pam_timestamp/pam_timestamp.c
@@ -158,7 +158,7 @@ check_tty(const char *tty)
tty = strrchr(tty, '/') + 1;
}
/* Make sure the tty wasn't actually a directory (no basename). */
- if (strlen(tty) == 0) {
+ if (!strlen(tty) || !strcmp(tty, ".") || !strcmp(tty, "..")) {
return NULL;
}
return tty;
@@ -243,6 +243,17 @@ get_ruser(pam_handle_t *pamh, char *ruserbuf, size_t ruserbuflen)
if (pwd != NULL) {
ruser = pwd->pw_name;
}
+ } else {
+ /*
+ * This ruser is used by format_timestamp_name as a component
+ * of constructed timestamp pathname, so ".", "..", and '/'
+ * are disallowed to avoid potential path traversal issues.
+ */
+ if (!strcmp(ruser, ".") ||
+ !strcmp(ruser, "..") ||
+ strchr(ruser, '/')) {
+ ruser = NULL;
+ }
}
if (ruser == NULL || strlen(ruser) >= ruserbuflen) {
*ruserbuf = '\0';

14
pam.spec
View file

@ -19,7 +19,7 @@ Epoch: 1
Summary: A security tool which provides authentication for applications
Name: pam
Version: 1.1.4
Release: 16
Release: 15
# The library is BSD licensed with option to relicense as GPLv2+ - this option is redundant
# as the BSD license allows that anyway. pam_timestamp and pam_console modules are GPLv2+,
License: BSD and GPLv2+
@ -71,6 +71,7 @@ Patch702: Linux-PAM-1.1.4-add-now-missing-nis-constant.patch
# (akdengi> add user to default group users which need for Samba
Patch801: Linux-PAM-1.1.4-group_add_users.patch
Patch802: pam-CVE-2014-2583.patch
BuildRequires: selinux-devel >= 2.1.6-7
BuildRequires: bison
@ -91,10 +92,10 @@ BuildConflicts: prelude-devel
%endif
Requires: cracklib-dicts
Requires: setup >= 2.7.12-2
Requires: pam_tcb >= 1.0.2-16
#Requires: pam_tcb >= 1.0.2-16
Requires(pre): rpm-helper
Requires(post): coreutils >= 8.12-7.2
Requires(post): tcb >= 1.0.2-16
#Requires(post): tcb >= 1.0.2-16
Conflicts: %{_lib}pam0 < 1.1.4-5
%description
@ -175,6 +176,7 @@ mv pam-redhat-%{pam_redhat_version}/* modules
%patch701 -p1 -b .nopermsd
%patch702 -p1 -b .nis_const~
%patch801 -p1 -b .group_users
%patch802 -p1
# 08/08/2008 - vdanen - make pam provide pam_unix until we can work out all the issues in pam_tcb; this
# just makes things easier but is not meant to be a permanent solution
@ -270,9 +272,9 @@ fi
if [ ! -a /var/log/tallylog ] ; then
install -m 600 /dev/null /var/log/tallylog
fi
if [ -f /etc/login.defs ] && ! grep -q USE_TCB /etc/login.defs; then
/usr/sbin/set_tcb --auto --migrate
fi
#if [ -f /etc/login.defs ] && ! grep -q USE_TCB /etc/login.defs; then
# /usr/sbin/set_tcb --auto --migrate
#fi
%files -f Linux-PAM.lang
%doc NEWS README.0.99.8.1.update.urpmi